{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:793f27c6-fab5-5343-b764-c0e844421da4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:033904c1-662e-5209-8da4-2ac682b55fb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2009-1190. The vulnerability requires Sun JDK before 1.6 (with algorithmic complexity issues in Pattern.compile), but Spring 5.1.13 requires JDK 8+ as confirmed in documentation and build configuration. The underlying JDK vulnerability was fixed in JDK 1.6 (2006), 14 years before Spring 5.1 was released. While Spring 5.1.13 still contains P...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:24dc944f-d094-532c-a576-90c8f54dcfac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc28d4c0-aea8-5399-b15f-900f051eb9b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d408aa1a-0f96-5417-8e89-9989cd145fa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5daf56cb-ea4c-5e28-8543-4156951159f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f238930f-c7d9-5b30-9ac7-6350a8f520de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac4453b7-47d7-586c-ad20-70083a81783b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38b80b92-e36a-5b24-9b9d-21b1dd5f34cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8291397-4d0e-5897-8fae-d768422f07e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6fba883d-2952-59a2-8573-6fc39fffe19e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d61c3ab-acdf-5f4a-abde-88024222f403", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:71e0d184-01f2-54d0-8c0b-6ac640c1f0af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:95cca86c-8e37-574e-9182-b6b2abb974d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac516dd6-d60a-5269-8ed4-b9731fd2e966", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:91e8eb4d-54e9-59c5-b09f-23b3f9c4aadd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a80e7c5d-9bbb-5b71-ac57-d9c097b71a7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:302d600b-d914-5b71-8fd4-8a294b602a9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96982cb2-6bdb-5b95-87fb-23a518b0145d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d058abbb-d888-55c4-b82b-30300cf4a003", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:566ad946-6a5d-5819-979b-3c508d573da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:43a03a04-4f37-5d45-94cd-0932d24c82bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b3fa14ab-b3ce-5f27-9d82-0d21919a2904", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a7967874-415e-535e-91ee-66f4ae13d480", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8cfa83a-3e06-521e-82e6-e4682c8b4b75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:25c76002-4b76-5dd2-b726-d3ecd7f03f0e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support. not_affected \u2014 The target version 5.1.13.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() vulnerability introduced by the CVE-2022-22968 fix, which made disallowedFields matching case-insensitive. However, version 5.1.13.RELEASE predates CVE-2022-22968 and uses case-SENSITIVE field matching without any toLowerCase() calls. The vulnerable code pattern (locale-depen...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc82ea1c-77ca-52b1-8e90-2ca3577988ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bfaae725-8b41-531e-b0ff-c39903352afc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9cfac4a9-8632-5c7b-8395-4d271af9ea94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7560017-ea3d-55f8-aab6-2065312ab88f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff59bc73-0094-5698-9929-a29950b45716", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab947d71-3262-5115-a57b-9bc42539d9aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:063ae725-7a9b-55c5-a82e-c1bcc80415e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4334ee5-d5ea-52a5-b7b5-8d9ef41b756a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6ec0dbd2-4dba-5ae9-9183-0caa637e2480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ffa6811c-260b-5bc9-874d-9ddf627fa372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5e98a6fa-726d-5109-be7d-16db38aa4334", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.13.RELEASE-tuxcare.1" } ] }